What is the CVSS score of CVE-2026-25996?

CVE-2026-25996 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-25996?

Yes, a public proof-of-concept exploit is available for CVE-2026-25996. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-25996?

Within 24 hours: Identify all systems running Inspektor Gadget and assess exposure in your Kubernetes environment. Within 7 days: Apply the available vendor patch to all affected instances and validate functionality post-patch. Within 30 days: Conduct a security audit of cluster access logs to detect any exploitation attempts and review RBAC policies limiting Inspektor Gadget access to authorized personnel only.

Inspektor Gadget CVE-2026-25996

Q: Which versions of Inspektor Gadget are affected by CVE-2026-25996?

Inspektor Gadget, a Kubernetes monitoring and inspection tool, contains a critical vulnerability (CVSS 9.8) that allows attackers to execute arbitrary commands through unsanitized terminal output.. A patch is available.

EUVD-2026-6695 CRITICAL

Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150)

2026-02-12 security-advisories@github.com

GHSA-34r5-6j7w-235f

Kubernetes Code Injection Inspektor Gadget Suse Linuxfoundation

9.8

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Container generates malicious eBPF event payload
Exploit

Event string with ANSI escape sequences reaches ig operator terminal
Execution

Control characters execute arbitrary terminal commands
Impact

Operator credentials/data compromised

Vulnerability Assessment

Weakness	CWE CWE-150 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Escape character neutralization
Exploitation Conditions	Inspektor Gadget running in default interactive columns output mode with eBPF event collection from untrusted or compromised containers in Kubernetes cluster or Linux host. No authentication required; attacker needs ability to generate observable container events.
Impact	CVSS 9.8. Kubernetes security tool — filter bypass can evade monitoring.
Exploit ScenarioDerived	Attacker crafts input that bypasses eBPF filter strings to evade monitoring or inject malicious filter logic.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

String filter bypass in Inspektor Gadget Kubernetes eBPF tooling before fix. Insufficient string escaping enables filter injection. PoC and patch available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:02 CVSS 9.8

Filter injection in Inspektor Gadget Kubernetes tool.

RemediationAI

Apply security update.

Affected VersionsENISA

inspektor-gadget < 0.49.1

Affected Packages

go github.com/inspektor-gadget/inspektor-gadget fix: 0.49.1

euvd inspektor_gadget fix: 0.49.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in go, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-150 string escaping bypass in eBPF filter construction.

Know when Inspektor Gadget gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE CRITICAL

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 16, 2026 - 18:02 vuln.today

Public exploit code

Patch released

Mar 16, 2026 - 18:02 nvd

Patch available

CVE Published

Feb 12, 2026 - 21:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. String fields from eBPF events in columns output mode are rendered to the terminal without any sanitization of control characters or ANSI escape sequences. Therefore, a maliciously forged - partially or completely - event payload, coming from an observed container, might inject the escape sequences into the terminal of ig operators, with various effects. The columns output mode is the default when running ig run interactively.

Executive ViewAI

Why It Matters

Inspektor Gadget, a Kubernetes monitoring and inspection tool, contains a critical vulnerability (CVSS 9.8) that allows attackers to execute arbitrary commands through unsanitized terminal output. Organizations using this tool for cluster management face immediate risk of system compromise, data exfiltration, and cluster-wide lateral movement if exploited by threat actors.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If patching is delayed: restrict network access to Inspektor Gadget interfaces using firewall rules, limit RBAC permissions to read-only modes where feasible, disable the column output rendering feature pending patch deployment, and monitor for suspicious terminal escape sequences in audit logs.

Threat Intelligence Overview

EPSS Score

0.1%

Top 84% exploitable

Threat Intel

1 source

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS GHSA Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +49

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Code Injection CRITICAL

Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.